Quick answer

If a loan, credit card, credit line, or similar account was opened using your identity without your consent, dispute it immediately in writing with the lender. State clearly that you did not apply, sign, authorize anyone, receive the proceeds, activate or use the account, or benefit from it—if those statements are true.

Ask the lender to:

Block further use or disbursement while investigating.
Mark the account and every related amount as formally disputed.
Suspend collection and adverse credit reporting pending investigation.
Preserve the application, contract, identification records, photographs or videos, electronic signatures, device and login records, call recordings, and disbursement trail.
Give you the account number, application date and channel, copies or legally disclosable details of the application and verification records, and the destination of any proceeds.
Correct its records and notify the Credit Information Corporation (CIC) and any credit bureau or collection agency to which it supplied incorrect information.
Confirm the result in writing.

Obtain a complaint reference number. A telephone report is useful for urgent blocking, but follow it with email, an online complaint, or a signed letter that you can prove was received.

A debt does not become yours merely because a lender’s records carry your name. A valid contract generally requires consent. However, liability can depend on evidence of authorization, electronic assent, receipt or use of proceeds, later acknowledgment, or other facts. Do not ignore the account, but do not sign a restructuring agreement, settlement, or acknowledgment—or make a “good faith” payment—without legal advice if the debt is not yours.

Act quickly, but use only verified channels

Take these steps as soon as possible:

Contact the lender’s fraud unit and consumer-assistance office. Get the contact details from the lender’s official website, app, branch, or regulator—not from the suspicious message or collection caller.
Secure the accounts that could have enabled the fraud. Change the passwords for your primary email, banking and e-wallet accounts, cloud storage, and mobile-carrier account. Use unique passwords, sign out unknown devices, and enable multi-factor authentication. If your SIM or phone was lost, replaced without authority, or suddenly stopped working, contact the telecommunications company immediately.
Check whether money passed through an account you control. If proceeds were credited to your bank or e-wallet, do not transfer, withdraw, return, or spend them based only on a stranger’s instructions. Notify the institution and obtain legal advice. The proper response may depend on where the funds came from and whether they remain traceable.
Report the suspected crime. File with the PNP Anti-Cybercrime Group or the nearest police cybercrime unit when technology was used, or with the NBI Cybercrime Division. A police or NBI report helps establish when you denied the transaction, but does not by itself cancel the account.
Review your credit information. Obtain a CIC Credit Report and dispute any unauthorized account through the CIC’s Online Dispute Resolution System.
Notify the lender’s data protection officer. Ask how your information was obtained, used, verified, shared, and secured. This starts the written-notice process that is normally required before a formal National Privacy Commission complaint.

What to say in the written dispute

Use direct, factual language. For example:

I formally dispute Account No. [masked number] as an unauthorized account created through identity fraud. I did not apply for, consent to, sign, activate, use, or authorize another person to obtain this account, and I did not receive or benefit from its proceeds. Please block further activity, mark the entire account as disputed, preserve all application and transaction records, stop collection and adverse reporting while the matter is investigated, and give me a written investigation result. Please also correct all information reported to the CIC, credit bureaus, collection agencies, and other recipients if the account is confirmed unauthorized.

Add:

Your full name and reliable contact details.
Only the identifying information reasonably needed to locate the account.
The date and manner in which you discovered it.
The account or application number, lender, amount, and relevant dates.
The specific facts you deny.
Any suspicious phone number, email address, device, delivery address, bank account, or e-wallet connected with the application.
A list of attached evidence.
The relief you want.
A request for acknowledgment, a case number, and the lender’s expected investigation schedule.

Send identification documents only through a verified, secure channel. Consider placing a visible notation on a copy—such as “For identity-theft dispute with [lender], [date] only”—provided it does not cover security features the lender legitimately needs to inspect.

Preserve evidence before accounts or messages disappear

Keep original electronic files whenever possible. Screenshots are helpful, but they should not be your only evidence.

Preserve:

Loan offers, approval messages, statements, demand letters, and collection notices.
Full emails, including headers, and complete chat threads with dates and account identifiers.
URLs, usernames, phone numbers, app names, and the app’s official store listing.
Call logs and any recordings lawfully made or supplied by the lender.
The envelope, card, SIM, or device delivered in connection with the account.
Your complaint emails, delivery receipts, ticket numbers, and the lender’s responses.
Your CIC Credit Report and every CIC dispute notice.
Evidence showing where you were or what contact details you used when the application was allegedly made.
Genuine signature samples from the relevant period if a handwritten signature is disputed.
Records of a lost ID, compromised email, unauthorized SIM replacement, or reported data breach.
Proof showing that the proceeds went to another person or account, if available.

Do not edit, crop, annotate, or repeatedly re-save the only copy of an electronic record. Keep a working copy and preserve the original with its metadata. Maintain a dated incident log identifying each call, message, report, and response.

What Philippine law generally provides

An account opened without consent is not automatically enforceable

Consent is an essential element of a contract under the Civil Code. The Supreme Court has repeatedly treated proven forgery and total absence of consent as legally significant; a notarized document is not immune from challenge when sufficient evidence shows it is fake. Still, merely alleging forgery may not be enough in a contested case. The documents, authentication process, proceeds, conduct of the parties, and other evidence matter. See the Supreme Court’s discussion in Chua v. Bank of Commerce.

This is why the safest immediate position is to deny the unauthorized account precisely, demand the lender’s evidence, preserve your own evidence, and avoid conduct that could be presented as acceptance.

Financial consumers have rights against fraud and misuse

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects rights that include fair treatment, protection of consumer assets against fraud and misuse, data privacy, and timely complaint handling. It covers digital as well as conventional financial products.

Claims arising under that Act generally prescribe five years from consummation of the transaction or five years from discovery of deceit or nondisclosure, but in any event ten years from the violation. Other civil and criminal causes of action may have different periods, so these limits are not a reason to delay reporting.

Using another person’s identity may be criminal

Depending on the evidence:

The Anti-Financial Account Scamming Act, Republic Act No. 12010, makes opening a financial account under a fictitious name or using another person’s identity or identification documents an offense. Its definition of financial account includes credit-card accounts and other accounts used to obtain financial products or services from BSP-supervised institutions.
The Cybercrime Prevention Act, Republic Act No. 10175, covers computer-related identity theft when identifying information is intentionally acquired, used, misused, transferred, possessed, altered, or deleted without right through information and communications technology.
The Access Devices Regulation Act, Republic Act No. 8484, addresses access devices obtained through false information, fictitious identities, falsified documents, or misrepresentation.

The applicable charge depends on what was opened, how the identity was used, what the offender intended, and what evidence investigators can obtain. A regulator complaint and a criminal report serve different purposes; neither automatically replaces the other.

You also have data-privacy rights

Under the Data Privacy Act, Republic Act No. 10173, personal information must have a lawful basis for processing. A data subject may have rights of access, correction, objection, and blocking or removal in circumstances defined by law.

Ask the lender’s data protection officer for the personal data associated with the application, its source, the purposes and basis for processing, recipients, and correction of inaccurate information. The right of access does not necessarily require disclosure of another person’s protected data, privileged material, or every confidential security control. Request what is needed, and ask the lender to explain any lawful limitation it invokes.

Escalate to the correct regulator

Banks, digital banks, e-wallet issuers, and other BSP-supervised institutions

First report the matter through the institution’s Financial Consumer Protection Assistance Mechanism. If its response is unsatisfactory or it does not act within a reasonable period, escalate through the BSP Consumer Assistance Mechanism.

The BSP identifies the following channels:

The BSP Online Buddy or BOB through the BSP website or the BSP’s official Facebook page.
If BOB is unavailable, submit the BSP Complaint/Inquiry/Reply form and proof that you first complained to the institution, following the BSP’s current complaint instructions.

The BSP’s procedural rules make the institution’s complaint mechanism the first-level recourse and BSP-CAM the second level. BSP-CAM does not cover ordinary lending companies, financing companies, cooperatives, or other entities outside BSP jurisdiction.

For qualifying disputes against BSP-supervised institutions, BSP adjudication is limited to claims that are purely civil and seek only payment or reimbursement of money not exceeding ₱10 million, exclusive of specified legal interest, attorney’s fees, and litigation costs. A case asking for other forms of relief may require a different proceeding or court action.

Lending and financing companies, including their online lending platforms

Complain first to the company’s consumer-assistance channel. If unresolved, file a ticket through the SEC’s official iMessage complaint portal. Attach the prior complaint, response or proof of nonresponse, account details, screenshots, police or NBI report if available, and the relief requested.

An app’s brand name may differ from the registered lending or financing company operating it. Identify both. If the operator is unclear or appears unlicensed, report that fact to the SEC and law enforcement rather than supplying more personal data or paying a supposed “verification” or “cancellation” fee.

Credit cooperatives

Use the cooperative’s Financial Consumer Protection Assistance Management System first. Unresolved complaints may be escalated through the CDA’s applicable consumer-assistance process or the CDA Extension Office with jurisdiction over the cooperative. CDA guidance identifies the cooperative mechanism as first-level recourse and CDA assistance as second-level recourse.

Correct an unauthorized account in your CIC Credit Report

The lender dispute and CIC dispute should proceed together.

The CIC’s published procedure requires a CIC Credit Report obtained within 30 days before filing the dispute. Use the report’s Transaction Reference Number and upload the report through the CIC Online Dispute Resolution System. There is no CIC dispute fee under its published citizen procedure.

The CIC explains that it cannot simply delete or change submitted credit data on its own; the dispute process involves the entity that supplied the information. Respond promptly to requests and to the submitting entity’s recommendation. The CIC’s published procedure and timetable vary according to how the dispute is classified and whether the submitting entity responds.

After the correction is confirmed, obtain a fresh report. Do not assume that closing the lender’s internal complaint automatically corrected every external report.

Special deadline for credit-card statement errors

If an unauthorized credit-card account also produced a statement containing fraudulent charges, invoke the credit-card billing-error procedure expressly.

Under BSP Circular No. 1003, covered issuers must give cardholders up to 30 calendar days from the statement date to report an error or discrepancy. The issuer must act within 10 business days after receiving the notice and relevant documents, and within 90 days must investigate, make appropriate corrections, and send a written explanation before collecting the contested amount, subject to the investigation’s result.

These deadlines address billing-statement disputes. They do not mean that a fabricated application becomes valid merely because the victim discovered it after 30 days. Report immediately even if the stated period has passed, and obtain legal advice if the issuer relies on lateness to reject an identity-fraud claim.

When to complain to the National Privacy Commission

Consider an NPC complaint when the lender or another organization may have unlawfully collected, used, disclosed, retained, or failed to secure your personal data, or refuses to address inaccurate personal information.

Under the amended 2021 NPC Rules of Procedure, you ordinarily must first:

Inform the lender, its data protection officer, or other responsible entity in writing of the privacy violation or breach; and
Show that it did not take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for proven good cause or a serious violation presenting a sufficient risk of harm.

Use the current NPC complaint form and filing instructions. The complaint must generally be written, verified or notarized in the required form, and supported by evidence. NPC Circular No. 2023-01 lists a ₱500 filing fee, a legal research fee, and additional fees when damages are claimed, subject to the stated exemptions for qualified indigent litigants and government entities. Check the current schedule when filing.

An NPC complaint concerns personal-data processing. It does not itself determine every issue of contractual liability, criminal guilt, or credit-report correction.

Dealing with collectors

Tell each collector in writing:

The account was opened without your authority.
The entire debt is disputed.
The matter has been reported to the lender under the complaint reference number.
All future communications should be documented.
Any credit reporting must reflect that the debt is disputed.

Keep every message, call log, threat, social-media post, and communication to relatives or employers. Do not give a collector an OTP, password, selfie-verification recording, contact-list access, or payment merely to “stop” the calls.

Threats, deceptive representations, disclosure of debt information to unauthorized third parties, and harassment may violate financial-consumer, collection, privacy, or criminal laws depending on the institution and conduct. Report them to the lender and its regulator; report privacy misuse to the NPC after satisfying or properly invoking an exception to its prior-notice rule. Contact the police immediately for threats of violence or imminent harm.

Common mistakes to avoid

Ignoring the account because “it is obviously fake.”
Reporting only by telephone and keeping no proof.
Clicking links or calling numbers supplied by the suspected fraudster.
Sending full IDs, selfies, signatures, or OTPs through an unverified channel.
Paying a cancellation, processing, investigation, or “account-clearing” fee.
Signing a restructuring or settlement document for a debt you deny.
Deleting the suspicious app, email, or messages before preserving evidence.
Posting unredacted IDs, account numbers, or complaint documents on social media.
Assuming a police blotter automatically cancels the debt.
Assuming the lender’s internal correction automatically updates the CIC.
Filing with the BSP against a company regulated by the SEC or CDA.
Missing a summons or formal legal notice while waiting for a regulator’s response.

When legal help is urgent

Consult a Philippine lawyer promptly if:

You receive a court summons, subpoena, demand for foreclosure, or notice involving collateral.
The lender threatens to offset the disputed debt against your deposits.
Loan proceeds entered an account you control or were partly used by you or a family member.
You previously shared an OTP, performed a selfie check, signed a document, or authorized someone to apply, but dispute the resulting account or amount.
The account is secured by land, a vehicle, salary deductions, or a guarantee.
Several accounts were opened or substantial losses and reputational damage are involved.
The lender presents documents bearing your apparent signature or biometric verification.
You need an urgent injunction, preservation order, or other relief that a regulator’s ordinary assistance process cannot provide.
A collector or offender is threatening, stalking, impersonating, or publicly exposing you.

If you cannot afford private counsel, ask the Public Attorney’s Office or an accredited legal-aid organization whether you qualify for assistance.

FAQ

Must I pay while the investigation is pending?

There is no safe universal answer. If the account was entirely fabricated and you neither authorized nor benefited from it, dispute the whole obligation rather than treating it as yours. If the account contains both authorized and unauthorized amounts, identify the disputed portion precisely. Obtain legal advice before withholding payment on any genuine obligation or making payment on a debt you deny.

Is an affidavit of denial enough?

It is useful evidence, especially when notarized, but it does not automatically resolve the dispute. Support it with contemporaneous records, the criminal-report reference, credit report, signature samples, device or SIM evidence, and proof concerning the proceeds.

Should I file with both the lender and the police?

Yes. The lender can block the account, preserve its records, investigate its onboarding process, correct its reporting, and identify the proceeds’ destination. Law enforcement investigates possible offenses. One process does not replace the other.

Can the CIC delete the account immediately?

Not unilaterally. CIC’s process brings the dispute to the entity that submitted the data. File using a credit report obtained within the required 30-day period, participate in the process, and obtain a new report after correction.

What if the lender refuses to give me the application?

Make a written access request identifying the personal data and records needed to understand and challenge the application. The lender may lawfully protect third-party data, privileged information, and confidential security details, but it should address your request and explain any limitation. Escalate unresolved financial-consumer and privacy issues to the appropriate regulator.

What if I discovered the account months or years later?

Report it now. Some special procedures have short notice periods, while FCPA claims have the five-year and ten-year limits described above. Other civil or criminal rules may differ. Delay can also make electronic evidence harder to recover.

Does filing a complaint guarantee that the account will be erased or that someone will be arrested?

No. Outcomes depend on the documents, authentication records, money trail, applicable law, and findings of the lender, regulators, investigators, prosecutors, or courts. Prompt, consistent reporting and well-preserved evidence materially improve the ability to investigate.

Official resources

This article provides general Philippine legal information, not legal advice for a particular case. Contractual liability, criminal offenses, regulatory jurisdiction, and available remedies depend on the documents and facts. Official sources and procedures were checked as of 24 July 2026.